- STAR Labs analysed 64 Android samples that are one remote-access tool (RAT) disguised as many fake finance, romance and TV apps.
- The disguises change, but the dropper's structure and install behaviour stay the same. STAR Labs used that structure, not brand names, to recognise the family.
- Teams should ask whether their mobile defences watch for app installs from outside the store, not only for known brand lures.
The costume changes. The engine does not.
Security teams often track threats by their disguise. A fake tax app gets one alert. A fake card-points app gets another. STAR Labs' latest research shows why that approach leaves gaps.
The research firm gathered 64 Android samples over the past month, first seen between 15 September and 16 October 2026. All of them share one design. A small first-stage app, called a dropper, installs a packed second program: a remote-access tool, or RAT, that lets an operator control the phone.
The fake fronts vary widely. They cover Japan's e-Tax service, card-points programmes from Rakuten and Mitsui Sumitomo, the Mercari marketplace and LINE. They also include a SpaceX "6G" investment offer, romance apps and live-TV players.
The thesis is simple. When the brand is disposable, the brand cannot be the thing you defend against. What persists is the structure underneath, and that is where detection should look.
How a fake tax app becomes a remote-control tool
The app a victim installs does not contain the RAT in plain view. It is a dropper that unpacks itself while running, then asks Android for the permission to install other apps (REQUEST_INSTALL_PACKAGES). It uses that permission to install a second app: the RAT.
STAR Labs says the dropper opens an install session through Android's package installer and, on Android 12 and later, asks the system not to show the usual confirmation. A receiver named Ir then launches the RAT once the install finishes. If Android still asks for approval, the receiver brings up the system dialog.
STAR Labs describes the RAT's capabilities as fitting a financial motive. It captures the lock-screen PIN or pattern, reads payment input, and mirrors and drives the screen. It also escalates its own access on the device. In the researchers' account, that lets an operator launch a banking or payment app and transfer funds while the victim's screen shows nothing unusual. They call the operation likely financially motivated.
The RAT talks to its operators over a WebSocket, a standard two-way web connection. Each request is signed per device, carries a timed message code and checks a pinned TLS certificate. STAR Labs notes this native authentication belongs to the build it dissected. Another build it examined ships a different native-library set.
Two control panels, live at once
Operators manage infected phones through a web panel with a hawk logo. It uses one of two Chinese names, "Black Hawk Android Remote Control" or "Eagle Android Remote". Both sit behind the same login page and tagline.
This is one finding from one research team's collection. It does not show how large the operation is or how many phones are infected. It does show that one engine can serve many fronts, finance lures and romance apps alike.
The packer's key sits in plain sight
The dropper is packed to hide its code. In the main sample, the packer's decryption key is stored inside the app in the clear. STAR Labs XORed the hidden file by hand with that key and read the result. XOR is a simple scramble that the same key undoes.
A second key, in the dropper's settings, decrypts the RAT itself. STAR Labs says these two keys unpack the whole chain, and it has published a decoder.
Some droppers use a different packer, the open-source nmmp, which hides the key behind a small virtual machine. STAR Labs did not need to break it here, because the same RAT also ships in the simpler packer. It argues that nmmp's virtual machine can still be rebuilt from published code.
What to ask your security team
STAR Labs found that every sample is signed with Android's default developer certificate. Many unrelated apps use it too, so grouping by it would catch innocent software. The researchers group by structure instead: the same four components, the install permission and a shared word list for package names.
That is a useful lesson for buyers. A detection that names a brand or a certificate may miss the next costume. Put three questions to your mobile and endpoint teams:
First, can staff phones install apps from outside the official store, and who approved that? Second, do your mobile defences flag an app that asks to install other apps, or do they match known lure names? Third, which staff use banking or payment apps on devices that also run unmanaged apps?
The brand on the icon is the attacker's choice. The structure underneath is what STAR Labs used to recognise the family. That is a sound place to aim detection spending.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: STAR Labs.
